B - ITIOSS O&M and DM&E Task Order PWS.docx

ATTACHMENT B: IT Infrastructure Operations Support Services (ITIOSS) O&M and DM&E Task Order Performance Work Statement

Table of Contents

Introduction This performance work statement (PWS) is for the delivery of professional services to support the PBGC’S Information Technology (IT) Infrastructure. The PBGC IT Infrastructure Operations Support Services (ITIOSS) contract provides a wide range of IT professional services supporting a diverse technological environment. The list of service domains includes end-user services; data center operations; voice, video, and network infrastructure operations; IT service management; infrastructure monitoring and reporting; cybersecurity services; test center operations; development, modernization and enhancements (DM&E); and disaster recovery/continuity of operations planning and testing. Program management is also necessary to oversee all contracted tasks for the service areas. Two areas of specific interest are cloud and mobile computing. In addition to limited task-specific, business-area driven cloud instances, PBGC has recently adopted cloud on an enterprise-wide basis for electronic mail, collaboration, office automation, individual user data storage and shared, unstructured data storage as well as IT service management. Mobile computing initiatives include the expansion of office automation to PBGC’s iPhones and the introduction of Surface Pro 4 tablets and enterprise wireless capabilities established in 2018. Cybersecurity is a particularly critical service domain and ITIOSS provides both IT security operations support as well as IT security analysis, ISSO support and audit support. These supporting services are implemented as an integral part of the solution throughout the entire enterprise.

Background The Pension Benefit Guaranty Corporation (PBGC) protects the retirement income of more than 40 million American workers in nearly 24,000 private-sector defined benefit pension plans. A defined benefit plan provides a specified monthly benefit at retirement, often based on a combination of salary and years of service. PBGC was created by the Employee Retirement Income Security Act (ERISA) of 1974 to encourage the continuation and maintenance of private-sector defined benefit pension plans, provide timely and uninterrupted payment of pension benefits, and keep pension insurance premiums at a minimum. PBGC is not funded by general tax revenues. PBGC collects insurance premiums from employers that sponsor insured pension plans, earns money from investments and receives funds from pension plans it takes over. A department within PBGC’s Office of Information Technology (OIT), the IT Infrastructure Operations Department (ITIOD) provides the mission-critical IT foundation for computing services used and procured by PBGC. PBGC cannot accomplish its mission without automated tools and business software. All other PBGC departments depend on this one for their IT support. PBGC’s Common Security Controls under the IT Infrastructure Services General Support Systems (ITISGSS) are also provided by this department. ITIOD is comprised of approximately 40 PBGC FTE and approximately 150 contractors. ITIOD stakeholders include a dedicated PBGC staff of approximately 2,250 government and contracted personnel, 26,000 pension plan sponsors who pay premiums into the PGBC and over 1.5 million trusteed participants who, combined, receive over $5 billion dollars in benefits payments.

Technology Overview

The following information is provided as a high-level overview of PBGC’s IT infrastructure environments and technology. Greater detail is provided in the succeeding delineations of the various service domains.

The PBGC currently operates and maintains three separate yet highly interrelated environments within its IT Infrastructure. Additionally, ITIOD provides limited support to the PBGC Office of Inspector General (OIG), as detailed in Appendix I - OIG IT Infrastructure Summary. These are logically separate infrastructures dedicated for (1) development, (2) testing, (3) production. Each is described below:

· The Common Development Environment (CDE) provides an area for development and interoperability testing that is isolated from production and other environments. The CDE provides the capability to develop major applications and infrastructure solutions, which support PBGC’s changing business needs. The environment allows PBGC to take advantage of emerging technologies and to improve the exchange of data with internal and external customers. The CDE is currently comprised of two separate areas (CDE-T and CDE-I):

· The CDE-T is the “Team-Specific” area, used for code development, COTS configuration and unit testing of development efforts.

· The CDE-I is the “Interoperability” area, used for various phases of testing (functional, system, integration, performance, and deployment) of future integrated releases. The CDE-I is further broken down into two sub-areas – “As Is” and “To Be.” The “As Is” area reflects the current production environment and is used for testing against applications that currently exist in production. This area may be used for supporting production, emergency fixes, and point releases. Currently this area also serves as the training environment for some custom developed PBGC applications. The “To Be” area reflects the future production environment and is used for testing against the applications that will be deployed in the next major software release and limited training purposes.

· The Integration and Testing Center (ITC) environment has been established for deployment verification, development shakedown, system integration verification and, user acceptance testing (UAT). Vulnerability scanning is also conducted for releases in the ITC prior to production release. Training can be performed in ITC when needed. Currently, testing (and training) in the ITC is accessed by physically going to the facility located at 1275 K Street, but over the next 6-12 months this is expected to become a virtual test center and access to it will be achieved entirely using remote desktop connectivity

· The Production environment (PROD) hosts business application and infrastructure operations including replication of software and data to the COOP site with similar hardware.

· The disaster recovery (DR) / COOP environment provides redundancy for the production environment and facilitates the continuation of business activities in the event of a disruption to the production environment. Failover is to PBGC’s servers at Wilmington, DE, which have similar cache boxes and web switches with server health monitoring and failover.

· The DMZ environment provides the infrastructure for public-facing applications and services. The DMZ includes its own Active Directory and has a presence at both the HQW and the COOP sites.

· PBGC also has several applications and infrastructure services that are largely supported externally and hosted off site including cloud and non-cloud managed services The application deployment process is initiated in the CDE by the development team. Solutions are then deployed to the ITC, based on a deployment guide prepared by the development team. This ITC deployment is a joint effort between the development team and the IT Infrastructure O&M team in that the IT Infrastructure O&M team performs the deployment and the development team monitors the deployment and is available to answer questions or assist with any issues that arise. The development team is responsible for the communication and coordination effort associated with the CDE, ITC and production deployments.

PBGC has more than 2,500 physical Windows workstations (desktops, laptops, and tablets) and more than 500 virtual desktops all of which run Windows 10. PBGC is moving towards portable hardware, e.g. MS Surface Pro 4, Latitude 5290 2-in-1, etc. PBGC also has approximately 1,000 GFE iPhone 6s devices managed using InTune and providing users with access to PBGC’s Microsoft Office 365 tenant including email. PBGC plans to upgrade these phones to the iPhone 8 plus model in 2018 just prior to the start of this contract. PBGC has established a significant SharePoint capability and Office 365 (Government Community Cloud E3 plan) as an enterprise collaboration tool. The majority of PBGC’s unstructured data resides on Office 365.

In support of all environments, ITIOD leverages a Hewlett-Packard (HP) blade server infrastructure, using VMWare for most systems. ITIOD takes a “virtualize first” approach whenever possible. Current server operating systems are a mix of Windows, Redhat Linux, and Solaris (physical Sun servers).

The PBGC applications and databases are a mixture of custom, COTS and highly customized COTS. Further, they have been designed, deployed and supported by multiple contractor teams, contracted for by multiple PBGC front-line business areas. PBGC primarily uses Oracle and MS SQL databases and is considering shifting its primary relational database services to MS SQL Server and other Microsoft Azure cloud database offerings, over a timeline yet to be determined. Furthermore, PBGC is considering shifting its many of its application middle-tier services from Oracle WebLogic and IIS to Azure and Dynamics cloud-based services, also over a timeline yet to be determined.

PBGC maintains Storage Area Network (SAN) infrastructure to provide high volume and high-performance data storage. PBGC primarily uses Brocade SAN switches connecting Hitachi storage arrays. PBGC also uses Veritas NetBackup and Oracle Recovery Manager (RMAN) for backup and recovery services.

ITIOD supports PBGC business functions through a number of core business applications, both custom and COTS, Microsoft Office 365 E3 including SharePoint online, and numerous supporting applications for office productivity including word processing, spreadsheet, graphics, email, collaboration, browser, communications connectivity, etc.

Core business applications presently use a mix of Web-based thin client World Wide Web Consortium (W3C)-compliant browser-based n-tier applications, client/server and service-based architectures. All current EA-compliant development is service- oriented with browser-based user interfaces.

PBGC supports secure remote access to networked resources via VPN on GFE devices. For non-GFE or devices, PBGC also offers an RDP web proxy service using Pulse Secure.

PBGC uses ServiceNow for IT Service Desk interactions, incident management, problem management, change management, asset management, configuration management and discovery. HP Service Manager 9 service request and service catalog software is used to manage service and access requests. PBGC plans to migrate these capabilities to the Service Now platform by the end of September 2019. SailPoint Identity IQ suite will also be leveraged to fulfill access requests for applications that are not Active Directory-integrated or federated to the extent possible.

PBGC uses HP Business Service Management (BSM) and HP Business Availability Center (BAC), Sitescope, Real User Monitor (RUM), and Network Node Manager (NNMi) for monitoring the availability and performance of IT infrastructure systems and applications.

PBGC uses the Microsoft Project On-line (referred to in PBGC as P3M) and Oracle/Primavera Project, Program and Portfolio Management (PPM) system as a central repository for tracking and reporting project data. Enterprise Architecture (EA) information is in the custom- developed EA Repository (EAR).

PBGC has selected Azure as its default IaaS and PaaS CSP and expects to shift more and more services to this over the next several years.

Contract Overview In addition to other requirements, this contract will also include following objectives:

1. In addition to operations and maintenance of the existing environment, this contract will include the infrastructure systems engineering and deployment services to perform development, modernization and enhancement work.

2. The performance of the contractor will be measured and evaluated based on Service Level Agreements (SLAs) comprised of a set of service level metrics with clearly defined acceptable levels of quality (AQL), which will be reviewed and adjusted as required quarterly.

3. The contractor shall be required to continuously identify, recommend, achieve, and report on measurable results for on-going operations and shall specifically provide before and after measurements that can quantify achievement of development results.

4. Gradually, under a phased approach and following the ITIOD roadmap, the current capital-intensive, government-owned, locally hosted infrastructure will be transitioned to alternative service delivery models.

Period of Performance The estimated period of performance is:

Base period: 11/1/2019 to 10/31/2020.

Option Periods: Nine (9) 12-month performance periods subject to exercise by PBGC Contract Transition Upon Government approval of the Transition Plan, the Contractor will assume responsibility for the operations and maintenance of the PBGC IT infrastructure. This phase will incorporate those activities – such as staff onboarding, knowledge transfer and asset inspection - that are deemed necessary by the PBGC and the Contractor to begin services under the new contract. The overarching objective of this phase is a low risk and low impact (to end-users) transition as the Contractor assumes responsibilities under the new ITIOSS program. Contract transition activities will include those activities defined in the Transition section.

Operations and Maintenance This phase consists of the on-going operations and maintenance of the ITIOSS environment after contract startup and transition activities have been completed. In this phase, the service objectives and requirements as defined in the Performance Work Statement (PWS) will be used to guide performance and ensure compliance with the agreed upon requirements. Service Level Agreements (SLAs) will take effect and on-going performance monitoring will be in place.

Contract Phase Out The Contractor shall provide transition phase-out support and various activities to transition support to the Federal Government or a third-party service provider at contract end-of-life. Contract phase-out activities will include those activities defined in the Contract Phase-out deliverable due 90 days before the end of any awarded period of the contract.

Business Process Support This section of the PWS outlines those services and requirements that relate to the ancillary yet critical business process that support ITIOD’s core mission, the provision of IT infrastructure services and tools.

5.1 Program and Process Management Support

The sections below describe the overview, objectives, scope, requirements, deliverables and SLAs of the Program and Process Management Support services that the Contractor shall provide under this solicitation.

Program and Process Management Overview The Contractor shall provide sufficient management to ensure that activities on the contract are performed efficiently, accurately, on time, and in compliance with requirements of the contract. Specifically, the Contractor shall designate key personnel to supervise staff assigned to this contract. The Contractor shall ensure that appropriate performance reports are submitted outlining progress, status, and any problems/issues encountered in the performance of the contract. The Contractor shall require all subcontractors to furnish performance report data where there are critical or significant tasks related to the prime contract.

Objectives The contractor shall consider the following objectives when providing program and process management services:

1) Ensure all IT infrastructure support services are provided timely, accurately, and in a quality manner, in full compliance with all service level objectives and metrics

2) Cost of services are controlled, and the total cost of infrastructure asset ownership is lowered on an annual basis via introduction of operational efficiencies

3) Development, modernization and enhancement projects are executed within initial cost and schedule baselines, and are fully responsive to documented user and system requirements

4) Provide transparency to customers and end-users on service cost, performance, and satisfaction Scope of Services Supported The Contractor will perform program management to include overall management, planning, accounting, tracking, reporting, and administrative support for ITIOSS. The Contractor's program management staff will work in cooperation with PBGC management to ensure processes and practices are defined, implemented, and evaluated on a regular basis in line with industry standard project management and service delivery models. All program and process management methodologies implemented and used by the Contractor shall be in compliance with the PBGC ITSLCM.

Requirements The Contractor shall perform the following services for the Program and Process Management services under this solicitation:

Reference (PM-PM-xx) Requirement

The Contractor shall provide technical staffing proficient in the tools and technologies utilized, supported, planned, and targeted under this contract. The contractor shall develop a set of experience and skills required for each role, position, and function on the contract. The set of experience and skills required for each role, position, and function on the contract shall be reviewed and approved/accepted by the government prior to the experience and skill definition to be considered as official for the services, roles, functions, and support provided and performed on the contract. Additionally, in those cases where hardware or software vendors require certified technicians to interact with their products, the Contractor shall ensure that personnel are appropriately certified. Appropriate certification documents shall be submitted to COR.

The Contractor shall establish a Technical Skill and Competency Maintenance Framework and Plan for:

· Equipping contractor staff with requested technology and related skills and competencies

· Identifying current technology, technology changing, and technology standards

· Addressing deficiencies in skills and competencies in contractor staff

· Managing technical risks to the contract due to insufficient technical skills and technical staff

· Addressing issues reported by the government with regards to technical skill deficiencies and technology deficiencies

The Contractor shall:

· Support, adhere to and make recommendations for improvement on the PBGC Project Management Methodology in accordance with PMI and other industry standards.

· Develop and maintain project management plans for each project in accordance with PMI Project Management Methodology standards and PBGC ITSLCM.

· Integration with the PBGC Asset Management, Configuration Management, and Service Desk processes.

· Installation and configuration of acquired components within established SLAs.

· Streamlined proposal process for non-standard PBGC hardware, software, or services

The Contractor shall communicate with the Government during all phases of the contract and, at a minimum, take steps to understand the Government’s business and technical issues, provide insight into issues and problems, recommend solutions for issues, and recommend actions to maintain cost, schedule, quality, and technical baselines. The Contractor shall have effective communications processes and plans to identify, prepare, review, incorporate review comments, disseminate, and track appropriate communication items (i.e., deliverables, work products, correspondence, etc.) for the ITIOSS Program.

Documentation and Reporting The Contractor shall be responsive to the development of reports and other document deliverables on a regular and ad-hoc basis to assist in oversight, IT governance, performance monitoring, and quality assurance/control of activities that impact the PBGC IT operations. Reports shall be made available online to PBGC staff, as needed, in agreed to formats and timeframes as outlined in the RFP.

Documentation services are the activities associated with developing, revising, maintaining, reproducing, and distributing up-to-date information in hard copy and/or electronic form across all service areas. These documents shall be collectively referenced as the ITIOSS Standards, Procedures, and Concept of Operations (CONOPS). The Contractor shall at a minimum:

· Provide documentation in agreed format to support activities throughout the life cycle of services as specified in each service area.

· Follow PBGC’s Record Management policies and procedures.

· Maintain a system to centrally store, organize and distribute documentation.

· Document system specifications and configurations, e.g. interconnection topology, configurations, and network diagrams).

· Document standard operating procedures (e.g., service desk, datacenter, network, boot, failover, spool management, batch processing, backup, etc.).

· Document procedures, production and maintenance schedules, and job schedules, according to PBGC policies and industry requirements.

· Document Meeting Minutes/Agendas: This document will be used to capture meeting agendas, attendees, meeting highlights, meeting outcomes and meeting action items.

· Develop, maintain, and update all documentation on a regular basis Refer to Appendix B – Deliverables and Appendix C- List of Required Meetings and Reports Transition The sections below describe the overview, objectives, scope, requirements, deliverables and SLAs of the Transition services that the Contractor shall provide under this solicitation.

Overview The Contractor shall submit a comprehensive Transition Plan in accordance with the PWS that shall contain a detailed description of tasks, resources, schedule, assumptions, dependencies, risks and risk mitigation plans associated with the transition.

Upon Government approval of the Transition Plan, the Contractor will assume responsibility for the operations and maintenance of the PBGC IT infrastructure. This task involves the transition of the existing environment to an environment that will support the core service areas as defined below. This phase will incorporate those activities – such as staff onboarding, knowledge transfer and asset inspection - that are deemed necessary by the PBGC and the Contractor to begin services under the new contract. The overarching objective of this phase is a low risk and low impact (to end-users) transition as the Contractor assumes responsibilities under the new ITIOSS program. This transition will involve the effort to set up the needed infrastructure (if applicable), staffing plans and other preliminary activities needed to prepare for the start of the contract. The overarching objective of this phase is a low risk and low impact (to end-users) transition as the Awarded Contractor assumes responsibilities under the ITIOSS program. Additionally, the Contractor shall specifically prepare for transition to an external, “rural-sourced” Service Desk akin to PBGC’s current model or an external Service Desk of another model.

Objectives The Contractor shall perform all services, tasks, and any other support activities required to transition from the current version of the ITIOSS contract. The existing services under this contract are vital to PBGC’s mission and must continue without interruption. The Contractor agrees to exercise best efforts and cooperation to affect an orderly and efficient transition phase after award.

PBGC has identified the following key service objectives for transition in the table below:

Scope of Services Supported Under Transition The Contractor shall provide all required personnel, management oversight, tools, processes, and other necessary resources to support fully support the transition from the current contractor. The Contractor will provide support in all Services areas identified in the PWS.

Requirements A startup transition period not to exceed sixty (60) days shall be required after final contract award for the Contractor to conduct transition services. During the transition period, the Contractor shall implement all activities necessary to sustain a stable IT infrastructure environment at PBGC, where the Contractor assumes operational control under PBGC’s Infrastructure Operations Department (ITIOD). Phase-in activities include the finalization and formal adoption of ITIOSS contract SLAs, coordination and activation of the business systems supporting the PBGC IT infrastructure environment and presentation of a Transition Readiness Review (TRR) in which specific readiness criteria and status are presented. The Contractor’s transition readiness includes satisfaction of a number of specific criteria including the establishment of:

1) Detailed transition plan, process and schedules coordinated with PBGC and incumbent contractors for providing an orderly transition with following objectives:

a. Minimize the impacts on continuity of operations

b. Maintain communication with staff and affected communities

c. Identify key issues

d. Overcome barriers to transition

e. Perform due diligence to ensure that all transition activities are identified, negotiated and completed during the Transition

f. Establish a transition management team capable of providing overall management and logistical support of all transition activities

2) Contractor transition management team leaders on-board immediately after the award.

3) Required operational interface agreements (e.g., OLAs, Memoranda of Agreement (MOA)) with incumbents prepared, reviewed, and signed.

4) Appropriate subcontractor and supplier agreements in place.

5) Qualified personnel identified, processed, and available at specific incremental turnover dates.

6) Applicable contractor management systems and support tools in place.

7) Status reporting requirements established, including applicable performance measurement reporting requirements

8) PBGC and contractor agreement on existing systems, plans, procedures, forms, and instructions to be used after transition.

9) Institutionalized knowledge of PBGC operations and technical requirements.

10) An appropriately sized external, “rural-sourced” Service Desk akin to PBGC’s current model or an external Service Desk of another model Transition Deliverables Under this contract, the following Transition deliverables are required:

Transition Plan shall include:

· Identifying functions, tasks, systems, and facilities required to establish transition priorities and sequence.

· Determining specific functions and tasks that constitute “clean” transition increments, resulting in clear contractor accountability.

· Aligning and integrating the schedules across teams to preclude any impacts to primary mission requirements.

· Clearly defining and documenting each party’s responsibilities.

· Developing definitive transition readiness criteria for review with PBGC.

· Establishing new contractor support systems and applications.

· Providing tasks, data, and schedules to PBGC that can be used for issuing applicable direction to the incumbent contractors for phase-down, coordination, and funding considerations.

· Providing end-user orientation and communication on services and support procedures.

· Developing procedures, reference manuals, and operational guides to support on-going operations and other pertinent information needed to properly takeover services.

· Importing of historical data to contractor and/or Government systems (if applicable).

· Implementing a detailed communication plan.

· Transferring hardware, hardware warranties, and software licenses (if applicable).

· Transferring all necessary business and/or technical documentation.

· Training to introduce Government customers, programs, and technical staff to the tools, methodologies, and technical processes.

· Implementing new procedures and processes.

· Completing all required deliverables and SLA definitions.

· Providing practical approach/process for high retention of the current staff

· All relevant information pertaining to the establishment of and transition to a Service Desk capability not located on PBGC’s premises.

· Obtain system passwords and change all passwords at the end of transition. Submit all new passwords in the repositories maintained by PBGC.

Transition Service Level Agreement The Contractor shall propose a set of SLAs for transition period. These SLAs shall be aligned with transition requirements, transition readiness and transition objectives identified in this section.

General Requirements The Contractor shall meet the following set of General Requirements under this solicitation.

Location of Documents and Records The Contractor shall publish all deliverables, reports, SOPs, Work Instructions and other required documents on PBGC’s instance of SharePoint on-line according to applicable ITIOD processes and procedures.

Cost Control The Contractor shall use the PBGC project management tool, P3M, for cost control and cost management and promote accurate program IT cost accounting, cost reporting and budgeting, and facilitate cost-effective service provision.

Contact List On no less than a monthly basis, the Contractor shall update the contact list, maintained on PBGC’s instance of SharePoint on-line, of personnel to call in the event the Government needs to make contact regarding the status of incident resolution and notify the COR upon completion. The list shall be updated no later than the 5th business day of each month and include the name, telephone number, email address, cellular telephone number and type of incidents or service area for which the person has responsibility.

Enterprise Architecture Compliance The Contractor shall adhere to and comply with the PBGC’s Enterprise Target Architecture (ETA) and EA Standards. The Contractor shall also adhere to process and procedures for PBGC’s Technical Review Board (TRB), (copy will be available in reading room) Product/Technology Selection and Project Reviews according to the ITSLCM.

Application/Solution Development and Release Support Requirements The Contractor shall participate in application/solution development Integrated Project Teams (IPT) as needed providing feedback on information technology security, technical feasibility, compliance with IT infrastructure standards and quality of project artifacts. This also extends to Infrastructure development IPT. Infrastructure IPTs will include UAT Use Case building and testing activities. This will result in end user acceptance of systems before infrastructure technology is approved for the production environment.

Maintenance and Outages The Contractor shall perform maintenance and other related activities that degrade or may degrade the performance of PBGC’s computing environments, operating systems, databases and applications during scheduled maintenance periods as outlined in Appendix H - IT Infrastructure Maintenance Schedule.

Inspection by Government Agencies The Contractor shall provide access to and cooperate with Government personnel conducting official inspections and surveys. Inspections will be made by agency representatives from, but shall not be limited to, Property Inspectors, the Inspector General (IG), the Office of the Director, other offices in PBGC such as the Workplace Solutions Department, as well as other Federal Government agencies such as the Occupational Safety and Health Administration (OSHA), Environmental Protection Agency (EPA), Government Accountability Office (GAO), and General Services Administration (GSA). For all correspondence assistance relating to any audits and all Congressional inquiries, the Contractor shall not actually draft any response. Input may be provided but the drafting of such responses will be done by the Government. Additionally, the Contractor shall only communicate with other government agencies through the COR.

Third Party Vendor Organizations In some instances, the Contractor will need to interface with other contractor organizations performing services in support of PBGC. Some examples include contractors performing specialized, one-time projects and vendors providing software development. The Government will facilitate the initial contact, as required, between the ITIOSS Contractor and these other contractor organizations. The Contractor shall attempt to resolve any issues that may arise with other contractor organizations and shall verbally notify the COR of unresolved issues in receiving support from or providing support to customers or other contractors within two working hours from the occurrence of a dispute over any issue. The Contractor shall notify the COR in writing of any unresolved issues within one business day. The terms of this Contract shall govern the Contractor’s interaction with Third Party Vendor Organizations, and the Contractor is not authorized to take actions not otherwise provided for under this Contract.

Processes, Procedures, and Work Instructions The Contractor shall, within 60 calendar days after award of the Contract, review ITIOD processes, procedures, and work…